Craft CMS 4.18.9 / 5.11.2: unauthenticated SQLi and privilege-escalation fixes (CVE-2026-123488–123491) · updates https://pwn.watch/i/craft-cms-sqli-priv-esc-nov-2026 Craft CMS published four security advisories fixed in 4.18.9 and 5.11.2 (and 5.11.2-only for one). CVE-2026-123488 is an unauthenticated SQL injection in the element search endpoint (CVSS 9.8) that lets remote attackers read/write the database and escalate to admin. CVE-2026-123491 is unauthenticated GraphQL eager-load SQLi (8.2). CVE-2026-123489 is control-panel blind SQLi via getNext/getPrev (7.1). CVE-2026-123490 is authenticated privilege escalation via getOwners() sandbox criteria (8.8, Craft 5.8.17–before 5.11.2). Upgrade to 4.18.9 or 5.11.2. en Fri, 06 Nov 2026 00:00:00 GMT Craft CMS 4.18.9 / 5.11.2: unauthenticated SQLi and privilege-escalation fixes (CVE-2026-123488–123491): Craft CMS publishes GHSA-qcvp-ggx3-97r6 (unauthenticated element-search SQLi), GHSA-mjj9-pjh4-r48g (GraphQL eager-load SQLi), GHSA-f6gf-r952-rxg6 (CP blind SQLi), and GHSA-r56r-f696-c8w9 (getOwners privilege escalation), fixed in 4.18.9 / 5.11.2. https://pwn.watch/i/craft-cms-sqli-priv-esc-nov-2026 https://pwn.watch/i/craft-cms-sqli-priv-esc-nov-2026#2026-11-06-ff3afeb0 Fri, 06 Nov 2026 00:00:00 GMT critical <p><a href="https://github.com/craftcms/cms/security/advisories/GHSA-qcvp-ggx3-97r6">Source</a></p> Craft CMS 4.18.9 / 5.11.2: unauthenticated SQLi and privilege-escalation fixes (CVE-2026-123488–123491): NVD publishes CVE-2026-123488 (CVSS 9.8) describing unauthenticated SQLi via the attribute parameter on the element search endpoint. https://pwn.watch/i/craft-cms-sqli-priv-esc-nov-2026 https://pwn.watch/i/craft-cms-sqli-priv-esc-nov-2026#2026-11-06-1a29822d Fri, 06 Nov 2026 00:00:00 GMT critical <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-123488">Source</a></p>